Google steals security page from Mozilla's Firefox

Google will take a page from Mozilla's playbook and block outdated plug-ins from launching, part of new efforts to keep Chrome users safer, the company said Monday.

In a post to the Chromium blog , a trio of Google security engineers announced that Chrome would refuse to run plug-ins if they were found to be out of date, and thus, potentially vulnerable to exploitation of known bugs.

Chromium is the name of the open-source development project that feeds into the Chrome browser.

Google did not spell out when the outdated plug-in blocking would be added to Chrome, saying only that it would take place "medium-term." Nor did the Google engineers specify which plug-ins would be blocked. Chrome will assist users in updating old plug-ins, they said.

Chrome will also display a warning when a site calls on an infrequently-used plug-in, said Chris Evans, Julien Tinnes and Michal Zalewski of Google's security team. "Some plug-ins are widely installed but typically not required for today's Internet experience," they said. "For most users, any attempt to instantiate such a plug-in is suspicious and Google Chrome will warn on this condition."

Evans, Tinnes and Zalewski did not elaborate on how Chrome would define "infrequently-used."

Google did not reply to requests for clarification and more information on the timeline of the impending changes to Chrome.

Chrome is following in the footsteps of Mozilla's Firefox, which already has outdated plug-in blocking.

Mozilla added basic plug-in checking to Firefox 3.5 last September, but fleshed out the feature in Firefox 3.6, which debuted in January. The newest Firefox checks browser plug-ins, such as Adobe's Flash Player or Apple 's QuickTime, to make sure they're up-to-date, then blocks vulnerable plug-ins from loading and shows users how to update the software.

Both Mozilla and Google have said their new features are a reaction to the rapidly-increasing number of attacks against vulnerable plug-ins, especially Adobe's Flash Player and Reader.

According to some estimates, attacks against browser plug-ins, particularly Adobe's popular Reader PDF viewer, are quickly climbing. In the first quarter of 2010, antivirus vendor McAfee said in April, PDF exploits accounted for 28% of all malware-bearing attack code .

The HP OfficeJet 250 Mobile Printer is a great device that fits perfectly into my fast paced and mobile lifestyle. My first impression of the printer itself was how incredibly compact and sleek the device was.

Reproduction in whole or in part in any form or medium without express written permission of IDG Communications is prohibited. Copyright 2013 IDG Communications.
ABN 14 001 592 650. All rights reserved.

Contact Us

With over 25 years of brand awareness and credibility, Good Gear Guide (formerly PC World Australia), consistently delivers editorial excellence through award-winning content and trusted product reviews.